feat(workspace): attach the bound workspace's integration engine

packages/opencode/src/altimate/api/client.ts

@@ -37,6 +37,11 @@ const DatamateSummary = z.object({
 const IntegrationSummary = z.object({
   id: z.coerce.string(),
   name: z.string().optional(),
+  // altimate_change start — catalog `type` (tool | mcp | code | api | extension).
+  // Extension-type integrations are RPC into a live VS Code host and have no
+  // meaning on the CLI surface; callers filter on this.
+  type: z.string().optional(),
+  // altimate_change end
   description: z.string().nullable().optional(),
   tools: z
     .array(
@@ -227,19 +232,33 @@ export namespace AltimateApi {
 
   async function request(creds: AltimateCredentials, method: string, endpoint: string, body?: unknown) {
     const url = `${creds.altimateUrl}${endpoint}`
-    const res = await fetch(url, {
-      method,
-      headers: {
-        "Content-Type": "application/json",
-        Authorization: `Bearer ${creds.altimateApiKey}`,
-        "x-tenant": creds.altimateInstanceName,
-      },
-      ...(body ? { body: JSON.stringify(body) } : {}),
-    })
-    if (!res.ok) {
-      throw new Error(`API ${method} ${endpoint} failed with status ${res.status}`)
+    // altimate_change start — upstream_fix: bound every API request. Without a
+    // signal a stalled server holds the caller indefinitely; the workspace attach
+    // awaited this on its critical path.
+    const controller = new AbortController()
+    const timeout = setTimeout(() => controller.abort(), 15_000)
+    // altimate_change end
+    try {
+      const res = await fetch(url, {
+        signal: controller.signal,
+        method,
+        headers: {
+          "Content-Type": "application/json",
+          Authorization: `Bearer ${creds.altimateApiKey}`,
+          "x-tenant": creds.altimateInstanceName,
+        },
+        ...(body ? { body: JSON.stringify(body) } : {}),
+      })
+      if (!res.ok) {
+        throw new Error(`API ${method} ${endpoint} failed with status ${res.status}`)
+      }
+      // The abort stays armed until the BODY is read. `fetch` resolves on
+      // headers, so clearing it here would leave a server that sends headers and
+      // then stalls mid-body hanging indefinitely — with the socket held open.
+      return await res.json()
+    } finally {
+      clearTimeout(timeout)
     }
-    return res.json()
   }
 
   export async function listDatamates() {

packages/opencode/src/altimate/tools/datamate.ts

@@ -8,11 +8,13 @@ import {
   listMcpInConfig,
   resolveConfigPath,
   findAllConfigPaths,
+  readMcpEntryFromDisk,
 } from "../../mcp/config"
 import { Instance } from "../../project/instance"
 import { Global } from "../../global"
 import { Log } from "@/altimate/util/log"
 import { DATAMATE_KEY, readDatamateTransportFromIde } from "../datamate-transport"
+import { pinnedWorkspace } from "../workspace/engine-sync"
 
 const log = Log.create({ service: "datamate" })
 
@@ -138,22 +140,45 @@ async function handleList() {
 
 async function handleListIntegrations() {
   try {
-    const integrations = await AltimateApi.listIntegrations()
+    const catalog = await AltimateApi.listIntegrations()
+    // altimate_change start — extension-type integrations need a live VS Code
+    // bridge and cannot work from the CLI. Hide them from this surface (the
+    // workspace UI still offers them), but say how many were hidden rather than
+    // pretending they don't exist.
+    const integrations = catalog.filter((i) => i.type !== "extension")
+    const hidden = catalog.length - integrations.length
+    // altimate_change end
     if (integrations.length === 0) {
+      // A catalog of nothing but extension-type entries filters down to empty,
+      // and the footer below never runs — so this branch used to report a
+      // genuinely empty catalog. Say what was hidden here too, or the model
+      // reports "no integrations" when the workspace in fact has several.
+      const omitted =
+        hidden > 0
+          ? ` ${hidden} extension-type integration${hidden === 1 ? " was" : "s were"} omitted — they require a live VS Code bridge and are not available from the CLI.`
+          : ""
       return {
-        title: "Integrations: none found",
-        metadata: { count: 0 },
-        output: "No integrations available.",
+        title: hidden > 0 ? `Integrations: none available on the CLI (${hidden} hidden)` : "Integrations: none found",
+        metadata: { count: 0, hidden },
+        output: `No integrations available.${omitted}`,
       }
     }
     const lines = ["ID | Name | Tools", "---|------|------"]
     for (const i of integrations) {
       const tools = i.tools?.map((t) => t.key).join(", ") ?? "none"
       lines.push(`${i.id} | ${i.name} | ${tools}`)
     }
+    // altimate_change start
+    if (hidden > 0) {
+      lines.push(
+        "",
+        `(${hidden} extension-type integration${hidden === 1 ? "" : "s"} omitted — they require a live VS Code bridge and are not available from the CLI.)`,
+      )
+    }
+    // altimate_change end
     return {
       title: `Integrations: ${integrations.length} available`,
-      metadata: { count: integrations.length },
+      metadata: { count: integrations.length, hidden },
       output: lines.join("\n"),
     }
   } catch (e) {
@@ -167,6 +192,19 @@ async function handleListIntegrations() {
 
 // DATAMATE_KEY is imported from altimate/datamate-transport.ts (shared constant).
 
+/** Is the configured gateway entry pinned to a DIFFERENT workspace than the one
+ * being asked for?
+ *
+ * The workspace attach persists this shared key with `--datamate <id>`, so
+ * "configured and connected" stopped meaning "serving whatever you asked for".
+ * An unpinned entry is the generic gateway and still answers for any datamate;
+ * a pin for another workspace does not, and saying otherwise would report success
+ * while the runtime served another workspace's tools and credentials. */
+export function isPinnedToOtherWorkspace(entry: unknown, datamateId: string | number): boolean {
+  const pin = pinnedWorkspace((entry ?? null) as never)
+  return pin !== null && pin !== String(datamateId)
+}
+
 async function handleAdd(args: { datamate_id?: string; name?: string; scope?: "project" | "global" }) {
   if (!args.datamate_id) {
     return {
@@ -228,8 +266,35 @@ async function handleAdd(args: { datamate_id?: string; name?: string; scope?: "p
         })
       }
 
-      if (existingNames.includes(DATAMATE_KEY)) {
-        // Already in config — just ensure it is connected in this session
+      // The workspace attach persists this same key PINNED to one workspace
+      // (`--datamate <id>`), so "configured and connected" no longer means "serving
+      // whatever you asked for". Reporting success here would tell the user their
+      // datamate is connected while the runtime kept serving another workspace's
+      // tools — and its credentials. A pin for a different workspace is replaced,
+      // which is what the user asked for by naming a datamate explicitly.
+      const configuredEntry = await readMcpEntryFromDisk(DATAMATE_KEY, configPath)
+      // Attribution is a claim about the RUNNING engine, so the running engine
+      // gets a vote here too. The config says what should run; MCP's spawn
+      // record says what IS running, and they diverge while a re-pin is in
+      // flight — during which this branch reported "already connected via
+      // datamate (N tools)" about a process serving a different workspace's
+      // data, under this workspace's name. Judging on the config alone is the
+      // same defect the attach flow was fixed for, surviving in its consumer.
+      const runningEntry = await MCP.spawned(DATAMATE_KEY).catch(() => undefined)
+      const pinnedElsewhere =
+        isPinnedToOtherWorkspace(configuredEntry, args.datamate_id) ||
+        (!!runningEntry && isPinnedToOtherWorkspace(runningEntry, args.datamate_id))
+      if (pinnedElsewhere) {
+        log.info("handleAdd: existing entry is pinned to another workspace; replacing", {
+          serverName: DATAMATE_KEY,
+          pinnedTo: pinnedWorkspace((configuredEntry ?? null) as never),
+          runningPinnedTo: pinnedWorkspace((runningEntry ?? null) as never),
+          requested: args.datamate_id,
+        })
+      }
+
+      if (existingNames.includes(DATAMATE_KEY) && !pinnedElsewhere) {
+        // Already in config for THIS datamate — just ensure it is connected.
         const allStatus = await MCP.status()
         if (allStatus[DATAMATE_KEY]?.status === "connected") {
           log.info("handleAdd: already connected, skipping add", {
@@ -258,7 +323,8 @@ async function handleAdd(args: { datamate_id?: string; name?: string; scope?: "p
         })
         await MCP.connect(DATAMATE_KEY)
       } else {
-        // Not in config yet — write to disk then connect
+        // Not in config yet, or pinned to a workspace other than the one asked
+        // for — write to disk then connect, replacing the pin either way.
         log.info("handleAdd: adding new datamate entry", {
           serverName: DATAMATE_KEY,
           type: mcpConfig.type,

packages/opencode/src/altimate/workspace/engine-chain.ts

@@ -0,0 +1,48 @@
+// altimate_change - new file
+//
+// Per-project serialization. Two attaches for the same project must not race to
+// `MCP.add`, because whichever lands LAST owns the runtime client.
+import { projectRoot } from "./engine-seams"
+
+/** In-flight attach chain per project.
+ *
+ * Per-session ordering is not enough: the MCP client is instance-wide, not per
+ * session, `MCP.add` is last-writer-wins, and `SessionRunState` keeps
+ * independent runners per session id — so two prompts in the same project
+ * genuinely overlap. Without this, a slower attach from one session can land
+ * after another session's and leave the runtime serving a workspace nobody is
+ * bound to, with both memos settled so no later turn repairs it. */
+export const attachChains = new Map<string, Promise<unknown>>()
+
+export function projectKey(): string {
+  try {
+    return projectRoot()
+  } catch {
+    return "<no-instance>"
+  }
+}
+
+export function serializeAttach<T>(fn: () => Promise<T>): Promise<T> {
+  const key = projectKey()
+  const previous = attachChains.get(key) ?? Promise.resolve()
+  // Run regardless of how the previous attach ended — a failure must not wedge
+  // the chain for the rest of the process.
+  const next = previous.then(fn, fn)
+  const tail = next.then(
+    () => {},
+    () => {},
+  )
+  attachChains.set(key, tail)
+  // Drop the entry once it settles, unless another attach has already queued
+  // behind it — otherwise every project path a long-running server opens is
+  // retained for the life of the process. Bounding `sessions` did not cover this.
+  void tail.then(() => {
+    if (attachChains.get(key) === tail) attachChains.delete(key)
+  })
+  return next
+}
+
+/** Test seam — how many project attach chains are currently retained. */
+export function trackedChainsForTests(): number {
+  return attachChains.size
+}